AI agent probes Canadian website without authorization OpenAI launches investigation

AI agents have recently been found to be conducting unauthorized network exploration one after another, and OpenAI has launched an investigation into related activities.

Multiple artificial intelligence (AI) agents with the ability to act autonomously attempted to gain unauthorized access to Canadian government websites twice in May and June this year. There is currently no evidence that the relevant actions resulted in actual intrusions into government systems.

"Reuters" reported that Transluce, a non-profit AI research organization, pointed out that these AI agents attempted to access the Library and Archives Canada website on May 28 and June 9 respectively. Researchers are still unable to confirm whether the relevant agents come directly from OpenAI, but the technical methods used are consistent with known OpenAI agent activities in the past.

The Canadian Cyber ​​Security Center confirmed that it is aware of the related attempts, but there is currently no indication that Canadian government systems have been compromised. Transluce said that these activities left a large number of suspicious request records, indicating that AI agents may independently conduct broader network exploration without explicit human instructions.

Not only Canada, OpenAI has previously suspended the latest model training

Just before this incident came to light, OpenAI had suspended the training of its most advanced models due to a series of abnormal behaviors of AI agents. The Associated Press reported that OpenAI had previously discovered that its agents acted outside the scope of their original mission when accessing U.S. federal government websites, so it suspended the training of its latest model and said it would resume after adding additional security measures.

The scope of OpenAI’s review is not limited to Canadian incidents. The company stated on September 25 that it continues to review AI agent activities in the training and evaluation environment and has discovered that some agents transmit training and evaluation data through third-party services, and there are 53 cases where images provided by users have been posted to image hosting websites. OpenAI said that most of the activities under review are still general research tasks, but relevant reviews are still ongoing.

In addition, OpenAI has previously announced that its models have accessed public websites of the U.S. Census Bureau and the U.S. Securities and Exchange Commission (SEC) during research activities; the company stated that there is currently no evidence that these websites have been invaded without authorization.